 | すみません。時間がかかってしまいました。
eScanとSilentRunnersのログです。eScanのScan中に一度ウィルス告知が出ました。どうぞよろしくお願いいたします。
-------------------------------------------------------------
----- eScanlog.txt ----
***** File system for Adware/Spyware *****
Offending file found: C:\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending file found: C:\WINDOWS\system32\lp.exe
System found infected with rapidblaster Spyware/Adware (lp.exe)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\なでしこプログラム\plug-ins\sqlite3.dll
System found infected with virtualpcguard Corrupted Adware/Spyware (sqlite3.dll)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\africamission2008\images\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\15\recruit_mov\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\15web\public_html\phpmyadmin\libraries\dbi
Object "toolbar Spyware/Adware" found in File System
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\15web\public_html\recruit_mov\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\15071203bk\recruit_mov\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\15080407\recruit_mov\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\15system_base\division\hh.html
System found infected with xtractor plus Spyware/Adware (hh.html)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\15system_base\new\division\hh.html
System found infected with xtractor plus Spyware/Adware (hh.html)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\16\webgaia041109\old\division\hh.html
System found infected with xtractor plus Spyware/Adware (hh.html)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\20\071117\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0312\0312\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0401\0401\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0402\0401\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0402\0402\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0404\0401\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0406\0401\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0406\0404\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0408\0401\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0410\0401\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0412\0401\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\shanai0501\0401\topics\big\npo
Object "netpal Spyware/Adware" found in File System
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\17\送った者たち\main.exe
System found infected with desktop scam Trojan-Downloader (main.exe)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\18\20050606\event\1.dat
System found infected with wareout Adware (1.dat)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\18\20050606\event\2.dat
System found infected with wareout Adware (2.dat)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\18\20050606\event\3.dat
System found infected with wareout Adware (3.dat)
Offending Folder found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\18\20050930\cgi-bin\mt\lib\mt\objectdriver\dbi
Object "toolbar Spyware/Adware" found in File System
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\18\20050930\event\1.dat
System found infected with wareout Adware (1.dat)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\18\20050930\event\2.dat
System found infected with wareout Adware (2.dat)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\18\20050930\event\3.dat
System found infected with wareout Adware (3.dat)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\19\olddata\yasuda020204\main.exe
System found infected with desktop scam Trojan-Downloader (main.exe)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081018\19\olddata\yasuda020205\main.exe
System found infected with desktop scam Trojan-Downloader (main.exe)
Offending file found: C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081108\player.html
System found infected with clipgenie Spyware/Adware (player.html)
Offending Folder found: C:\Documents and Settings\【user】\Local Settings\application data\winamp toolbar\ietoolbar
Object "softomate toolbar Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\【user】\Local Settings\Application Data\winamp toolbar\ietoolbar
Object "softomate toolbar Spyware/Adware" found in File System
Offending Folder found: C:\Documents and Settings\All Users\Application Data\winamp toolbar\ietoolbar
Object "softomate toolbar Spyware/Adware" found in File System
Offending Registry Entry found: hklm\software\classes\clsid\madown
System found infected with combo Spyware/Adware (hklm\software\classes\clsid\madown)
Offending Registry Entry found: hkcr\clsid\madown
System found infected with combo Spyware/Adware (hkcr\clsid\madown)
Offending file found: C:\WINDOWS\system32\optserve.dll
System found infected with optserve Adware (C:\WINDOWS\system32\optserve.dll)
Offending file found: C:\WINDOWS\system32\lp.dll
System found infected with optserve Adware (C:\WINDOWS\system32\lp.dll)
Offending file found: C:\WINDOWS\system32\optserve.exe
System found infected with optserve Adware (C:\WINDOWS\system32\optserve.exe)
Offending file found: C:\WINDOWS\system32\lp.exe
System found infected with optserve Adware (C:\WINDOWS\system32\lp.exe)
Offending Registry Entry found: hklm\system\currentcontrolset\services\6to4
System found infected with combo Spyware/Adware (hklm\system\currentcontrolset\services\6to4)
Invalid Command Found in {3543da4e-c2af-11dd-8c1d-000a79a751c6}\Shell\AutoRun\command: E:\ampfrb.cmd
Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3543da4e-c2af-11dd-8c1d-000a79a751c6} !!!
Invalid Command Found in {789f28fe-bcf6-11dd-8c0c-001fc6b3e2ec}\shell\Autoplay\DropTarget\verb1\command: desktop.exe
Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{789f28fe-bcf6-11dd-8c0c-001fc6b3e2ec} !!!
***** Virus *****
C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081108\Aptana_Studio_Setup.exe = Virus "NULL.Corrupted"
C:\Documents and Settings\【user】\デスクトップ\要整理081204\要整理081108\Aptana_Studio_Setup.exe = Virus "NULL.Corrupted"
J:\WINDOWS\UnXlPdfDrv_ShunkanPDFZERO.exe = Virus "NULL.Corrupted"
***** Adware/Spyware *****
----- End of eScanlog.txt ----
------＜ここからSilentRunnersログ＞-------------------
"Silent Runners.vbs", revision 59, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Google Update" = ""C:\Documents and Settings\【user】\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c" ["Google Inc."]
"Winlock" = "c:\program files\left arm technology\***\winlock.exe (unwritable string)" ["Left Arm Technology."]
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"IMJPMIG8.1" = ""C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32" [MS]
"PHIME2002ASync" = "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC" [MS]
"PHIME2002A" = "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName" [MS]
"LanguageShortcut" = ""C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"" [null data]
"NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"]
"OfficeScanNT Monitor" = ""C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow" ["Trend Micro Inc."]
"JobHisInit" = "C:\Program Files\RMClient\JobHisInit.exe" ["RICOH COMPANY,LTD."]
"MplSetUp" = "C:\Program Files\RMClient\MplSetUp.exe" ["RICOH COMPANY,LTD."]
"UIRESIDENT" = "C:\Program Files\Corega\client utility\CrgUtil.exe" [empty string]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"Adobe Version Cue CS2" = ""C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"" ["Adobe Sytems Incorporated"]
"Acrobat Assistant 8.0" = ""C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"" ["Adobe Systems Inc."]
"Adobe_ID0EYTHM" = "C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" ["Adobe Systems Incorporated"]
"StartCCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun" ["Advanced Micro Devices, Inc."]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"QuickTime Task" = ""C:\Program Files\QuickTime\QTTask.exe" -atboottime" ["Apple Inc."]
"AppleSyncNotifier" = "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" ["Apple Inc."]
"iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Inc."]
"MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS]
"Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{1F68E72C-50E5-44B8-8F56-6A54D3AF1DA4}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Yahoo!*************" (unwritable string)
\InProcServer32\(Default) = "C:\Program Files\Yahoo!J\Toolbar\7_0_0_12\Modules\ypho.dll" ["Yahoo Japan Corporation. "]
{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\(Default) = "Winamp Toolbar Loader"
-> {HKLM...CLSID} = "Winamp Toolbar Loader"
\InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."]
{3049C3E9-B461-4BC5-8870-4C09146192CA}\(Default) = (no title provided)
-> {HKLM...CLSID} = "RealPlayer Download and Record Plugin for Internet Explorer"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll" ["RealPlayer"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]
{A65852E0-2E2B-4A45-B9DC-52B97224F0C9}\(Default) = (no title provided)
-> {HKLM...CLSID} = "CiPROIEhelper Class"
\InProcServer32\(Default) = "C:\Program Files\CaptIt4\CiToolbar\CiPROIEHob.dll" ["CRAFTEC Corp."]
{AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Conversion Toolbar Helper"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\(Default) = (no title provided)
-> {HKLM...CLSID} = "EpsonToolBandKicker Class"
\InProcServer32\(Default) = "C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]
{EEBA90E6-2B14-413F-9BF8-61A8BDF92258}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Yahoo!*********" (unwritable string)
\InProcServer32\(Default) = "C:\Program Files\Yahoo!J\Toolbar\7_0_0_12\Modules\YahooToolBar.dll" ["Yahoo! JAPAN"]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "****** ** CPL **" (unwritable string)
-> {HKLM...CLSID} = "****** ** CPL **" (unwritable string)
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band"
-> {HKLM...CLSID} = "History Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
-> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
"{01E51A0C-CFD0-4C48-9C7C-4DA07745BC84}" = "Lhaplus Version 1.55. Copyright (C) 2000-2007 Schezo <schezo@kfy.biglobe.ne.jp>."
-> {HKLM...CLSID} = "Lhaplus Version 1.55. Copyright (C) 2000-2007 Schezo <schezo@kfy.biglobe.ne.jp>."
\InProcServer32\(Default) = "C:\PROGRA~1\Lhaplus\LplsShlx.dll" [null data]
"{00A1BC14-07C3-4810-ABF7-73291D156AE1}" = "Lhaplus Version 1.55. Copyright (C) 2000-2007 Schezo <schezo@kfy.biglobe.ne.jp>."
-> {HKLM...CLSID} = "Lhaplus Version 1.55. Copyright (C) 2000-2007 Schezo <schezo@kfy.biglobe.ne.jp>."
\InProcServer32\(Default) = "C:\PROGRA~1\Lhaplus\LplsShlx.dll" [null data]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{4EFE464B-3D0B-4800-A5DE-2321283A3256}" = "QCD IconHandler"
-> {HKLM...CLSID} = "QIconHandler Class"
\InProcServer32\(Default) = "C:\Program Files\Quintessential Player\QCDIcons.dll" [empty string]
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
-> {HKLM...CLSID} = "SimpleShlExt Class"
\InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll" ["Advanced Micro Devices, Inc."]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {HKLM...CLSID} = "iTunes"
\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]
HKLM\SYSTEM\CurrentControlSet\Control\WOW\
<<!>> "cmdline" = "C:\WINDOWS\system32\ntvdm.exe -o" [MS]
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{04DAAD08-70EF-450E-834A-DCFAF9B48748}\(Default) = "Folder Size column"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\FolderSize\FolderSizeColumn.dll" ["Brio"]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]
HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
-> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
EPPShellEx\(Default) = "{509FE1AF-ADD5-49EC-BC55-7CF81FD16E78}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\EPSON\Creativity Suite\Easy Photo Print\EPPShell.dll" ["SEIKO EPSON CORPORATION"]
Lhaplus\(Default) = "{00A1BC14-07C3-4810-ABF7-73291D156AE1}"
-> {HKLM...CLSID} = "Lhaplus Version 1.55. Copyright (C) 2000-2007 Schezo <schezo@kfy.biglobe.ne.jp>."
\InProcServer32\(Default) = "C:\PROGRA~1\Lhaplus\LplsShlx.dll" [null data]
HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
Lhaplus\(Default) = "{00A1BC14-07C3-4810-ABF7-73291D156AE1}"
-> {HKLM...CLSID} = "Lhaplus Version 1.55. Copyright (C) 2000-2007 Schezo <schezo@kfy.biglobe.ne.jp>."
\InProcServer32\(Default) = "C:\PROGRA~1\Lhaplus\LplsShlx.dll" [null data]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Windows Portable Device AutoPlay Handlers
-----------------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\
BridgeCS3ImportMediaOnArrival\
"Provider" = "Adobe Bridge CS3"
"InvokeProgID" = "Adobe.adobebridge"
"InvokeVerb" = "launch"
HKLM\SOFTWARE\Classes\Adobe.adobebridge\shell\launch\command\(Default) = "C:\Program Files\Adobe\Adobe Bridge CS3\bridgeproxy.exe -v %1" ["Adobe Systems, Inc."]
EpsonCreativitySuite\
"Provider" = "FileManager"
"InvokeProgID" = "EpsonCreativitySuite"
"InvokeVerb" = "Play"
HKLM\SOFTWARE\Classes\EpsonCreativitySuite\shell\Play\DropTarget\CLSID = "{7720BCC1-4F11-4f17-A80F-0BB69EF9788F}"
-> {HKLM...CLSID} = (no title provided)
\LocalServer32\(Default) = "C:\Program Files\EPSON\Creativity Suite\File Manager\eppqcom.exe" [null data]
iTunesBurnCDOnArrival\
"Provider" = "iTunes"
"InvokeProgID" = "iTunes.BurnCD"
"InvokeVerb" = "burn"
HKLM\SOFTWARE\Classes\iTunes.BurnCD\shell\burn\command\(Default) = ""C:\Program Files\iTunes\iTunes.exe" /AutoPlayBurn "%L"" ["Apple Inc."]
iTunesImportSongsOnArrival\
"Provider" = "iTunes"
"InvokeProgID" = "iTunes.ImportSongsOnCD"
"InvokeVerb" = "import"
HKLM\SOFTWARE\Classes\iTunes.ImportSongsOnCD\shell\import\command\(Default) = ""C:\Program Files\iTunes\iTunes.exe" /AutoPlayImportSongs "%L"" ["Apple Inc."]
iTunesPlaySongsOnArrival\
"Provider" = "iTunes"
"InvokeProgID" = "iTunes.PlaySongsOnCD"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\iTunes.PlaySongsOnCD\shell\play\command\(Default) = ""C:\Program Files\iTunes\iTunes.exe" /playCD "%L"" ["Apple Inc."]
iTunesShowSongsOnArrival\
"Provider" = "iTunes"
"InvokeProgID" = "iTunes.ShowSongsOnCD"
"InvokeVerb" = "showsongs"
HKLM\SOFTWARE\Classes\iTunes.ShowSongsOnCD\shell\showsongs\command\(Default) = ""C:\Program Files\iTunes\iTunes.exe" /AutoPlayShowSongs "%L"" ["Apple Inc."]
MSWPDShellNamespaceHandler\
"Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501"
"CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}"
"InitCmdLine" = " "
-> {HKLM...CLSID} = "WPDShextAutoplay"
\LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS]
NeroAutoPlay7CDAudio\
"Provider" = "Nero Express Essentials"
"InvokeProgID" = "Nero.AutoPlay7"
"InvokeVerb" = "CDAudio_HandleCDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\CDAudio_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe -w /New:AudioCD" ["Nero AG"]
NeroAutoPlay7CopyCD\
"Provider" = "Nero Express Essentials"
"InvokeProgID" = "Nero.AutoPlay7"
"InvokeVerb" = "CopyCD_PlayMusicFilesOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\CopyCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe -w /Dialog:DiscCopy" ["Nero AG"]
NeroAutoPlay7DataDisc\
"Provider" = "Nero Express Essentials"
"InvokeProgID" = "Nero.AutoPlay7"
"InvokeVerb" = "DataDisc_HandleCDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\DataDisc_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Core\nero.exe -w /New:ISODisc" ["Nero AG"]
NeroAutoPlay7LaunchNeroStartSmart\
"Provider" = "Nero StartSmart Essentials"
"InvokeProgID" = "Nero.AutoPlay7"
"InvokeVerb" = "LaunchNeroStartSmart_HandleCDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay7\shell\LaunchNeroStartSmart_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe /AutoPlay" ["Nero AG"]
PDVDPlayCDAudioOnArrival\
"Provider" = "PowerDVD"
"InvokeProgID" = "AudioCD"
"InvokeVerb" = "PlayWithPowerDVD"
HKLM\SOFTWARE\Classes\AudioCD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" "%L"" ["CyberLink Corp."]
PDVDPlayDVDMovieOnArrival\
"Provider" = "PowerDVD"
"InvokeProgID" = "DVD"
"InvokeVerb" = "PlayWithPowerDVD"
HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" "%l"" ["CyberLink Corp."]
PDVDPlayVCDMovieOnArrival\
"Provider" = "PowerDVD"
"InvokeProgID" = "VCD"
"InvokeVerb" = "PlayWithPowerDVD"
HKLM\SOFTWARE\Classes\VCD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" "%l"" ["CyberLink Corp."]
PStarterBlankCDArrival\
"Provider" = "DVD Suite"
"InvokeProgID" = "BlankCD"
"InvokeVerb" = "OpenWithPowerStarter"
HKLM\SOFTWARE\Classes\BlankCD\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"]
PStarterDVDBurningOnArrival\
"Provider" = "DVD Suite"
"InvokeProgID" = "BlankDVD"
"InvokeVerb" = "OpenWithPowerStarter"
HKLM\SOFTWARE\Classes\BlankDVD\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"]
PStarterMixedCDArrival\
"Provider" = "DVD Suite"
"InvokeProgID" = "MixedContent"
"InvokeVerb" = "OpenWithPowerStarter"
HKLM\SOFTWARE\Classes\MixedContent\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"]
PStarterMusicFilesArrival\
"Provider" = "DVD Suite"
"InvokeProgID" = "MusicFiles"
"InvokeVerb" = "OpenWithPowerStarter"
HKLM\SOFTWARE\Classes\MusicFiles\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"]
PStarterPicturesArrival\
"Provider" = "DVD Suite"
"InvokeProgID" = "Picture"
"InvokeVerb" = "OpenWithPowerStarter"
HKLM\SOFTWARE\Classes\Picture\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"]
PStarterPlayCDAudioOnArrival\
"Provider" = "DVD Suite"
"InvokeProgID" = "AudioCD"
"InvokeVerb" = "PlayWithPowerStarter"
HKLM\SOFTWARE\Classes\AudioCD\shell\PlayWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe" "%L"" ["CyberLink"]
PStarterPlayDVDMovieOnArrival\
"Provider" = "DVD Suite"
"InvokeProgID" = "DVD"
"InvokeVerb" = "PlayWithPowerStarter"
HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe" "%L"" ["CyberLink"]
PStarterVideoFilesArrival\
"Provider" = "DVD Suite"
"InvokeProgID" = "VideoFiles"
"InvokeVerb" = "OpenWithPowerStarter"
HKLM\SOFTWARE\Classes\VideoFiles\shell\OpenWithPowerStarter\Command\(Default) = ""C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"" ["CyberLink"]
RPCDBurningOnArrival\
"Provider" = "RealPlayer"
"InvokeProgID" = "RealPlayer.CDBurn.6"
"InvokeVerb" = "open"
HKCU\Software\Classes\RealPlayer.CDBurn.6\shell\open\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /burn "%1"" ["RealNetworks, Inc."]
RPDeviceOnArrival\
"Provider" = "RealPlayer"
"ProgID" = "RealPlayer.HWEventHandler"
HKLM\SOFTWARE\Classes\RealPlayer.HWEventHandler\CLSID\(Default) = "{67E76F1D-BDE2-4052-913C-2752366192D2}"
-> {HKLM...CLSID} = "RealNetworks Scheduler"
\LocalServer32\(Default) = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -autoplay" ["RealNetworks, Inc."]
RPPlayCDAudioOnArrival\
"Provider" = "RealPlayer"
"InvokeProgID" = "RealPlayer.AudioCD.6"
"InvokeVerb" = "play"
HKCU\Software\Classes\RealPlayer.AudioCD.6\shell\play\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /play %1 " ["RealNetworks, Inc."]
RPPlayDVDMovieOnArrival\
"Provider" = "RealPlayer"
"InvokeProgID" = "RealPlayer.DVD.6"
"InvokeVerb" = "play"
HKCU\Software\Classes\RealPlayer.DVD.6\shell\play\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /dvd %1 " ["RealNetworks, Inc."]
RPPlayMediaOnArrival\
"Provider" = "RealPlayer"
"InvokeProgID" = "RealPlayer.AutoPlay.6"
"InvokeVerb" = "open"
HKCU\Software\Classes\RealPlayer.AutoPlay.6\shell\open\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /autoplay "%1"" ["RealNetworks, Inc."]
WinampMTPHandler\
"Provider" = "Winamp"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = "C:\Program Files\Winamp\winamp.exe"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
-> {HKLM...CLSID} = "ShellExecute HW Event Handler"
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]
WinampPlayMediaOnArrival\
"Provider" = "Winamp"
"InvokeProgID" = "Winamp.File"
"InvokeVerb" = "Play"
HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"]
HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}"
-> {HKLM...CLSID} = (no title provided)
\LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"]
Startup items in "【user】" & "All Users" startup folders:
----------------------------------------------------------
C:\Documents and Settings\All Users\スタート メニュー\プログラム\スタートアップ
"Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"XeloPDFDriver2" -> shortcut to: "C:\Program Files\Common Files\Xelo\PDFDriver2\assistxpdf2.exe" ["Xelo, Inc."]
Enabled Scheduled Tasks:
------------------------
"AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."]
"GoogleUpdateTaskUser" -> launches: "C:\Documents and Settings\【user】\Local Settings\Application Data\Google\Update\GoogleUpdate.exe /c" ["Google Inc."]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Inc."]
Transport Service Providers
HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 58
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"
-> {HKLM...CLSID} = "Winamp Toolbar"
\InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."]
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}"
-> {HKLM...CLSID} = "EPSON Web-To-Page"
\InProcServer32\(Default) = "C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]
"{F2CF5485-4E02-4F68-819C-B92DE9277049}"
-> {HKLM...CLSID} = "&Links"
\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" = "Winamp Toolbar"
-> {HKLM...CLSID} = "Winamp Toolbar"
\InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."]
"{86A10B79-8C1C-4BEC-914B-BFC1450CB944}" = "CaptureIt"
-> {HKLM...CLSID} = "CaptureItPRO"
\InProcServer32\(Default) = "C:\Program Files\CaptIt4\CiToolbar\CiPROIEToolBar.dll" ["CRAFTEC Corp."]
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
"{AEF44653-C059-42CB-A5B7-41C640DA4A67}" = "*hI" (unwritable string)
-> {HKLM...CLSID} = "Yahoo!*****" (unwritable string)
\InProcServer32\(Default) = "C:\Program Files\Yahoo!J\Toolbar\7_0_0_12\Modules\YahooToolBar.dll" ["Yahoo! JAPAN"]
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}" = (no title provided)
-> {HKLM...CLSID} = "EPSON Web-To-Page"
\InProcServer32\(Default) = "C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]
Explorer Bars
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
{182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun の Java コンソール"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_07"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_07"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."]
{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
Miscellaneous IE Hijack Points
------------------------------
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}" = (no title provided)
-> {HKLM...CLSID} = "Winamp Search Class"
\InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
Adobe Version Cue CS2, Adobe Version Cue CS2, ""C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service" ["Adobe Systems Incorporated"]
Apple Mobile Device, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple Inc."]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Bonjour **** (unwritable string), Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Inc."]
Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared Files\RichVideo.exe"" [empty string]
FLEXnet Licensing Service, FLEXnet Licensing Service, ""C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"" ["Macrovision Europe Ltd."]
Folder Size, FolderSize, ""C:\Program Files\FolderSize\FolderSizeSvc.exe"" ["Brio"]
GTWPSSRV, GTWPSService, "C:\Program Files\Corega\client utility\gtwpssrv.exe" [null data]
iPod **** (unwritable string), iPod Service, ""C:\Program Files\iPod\bin\iPodService.exe"" ["Apple Inc."]
IPv6 Helper Service, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]}
OfficeScanNT Listener, tmlisten, "C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe" ["Trend Micro Inc."]
OfficeScanNT RealTime Scan, ntrtscan, "C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe" ["Trend Micro Inc."]
RESCRGEX, RESCRGEX, "C:\Program Files\Corega\client utility\WLService.exe" [null data]
Print Monitors:
---------------
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."]
BC ExPrinter Port\Driver = "BcEMonNT2.dll" ["Black Ice Software"]
Canon BJ Language Monitor MP830\Driver = "CNMLM7Q.DLL" ["CANON INC."]
Canon MP FAX Language Monitor MP830\Driver = "CNCF2Lb.DLL" ["Canon Inc."]
EPSON PM-G860 32MonitorBJ\Driver = "E_FLBCKJ.DLL" ["SEIKO EPSON CORPORATION"]
KING JIM SR520 Language Monitor\Driver = "TEP520LM.DLL" ["KING JIM CO.,LTD"]
RICOH Language Monitor2\Driver = "rc4mon.dll" ["RICOH CO.,Ltd."]
Ridoc IO Navi\Driver = "RPNV2MON.DLL" ["RICOH COMPANY,LTD."]
Xelo PDF Monitor2\Driver = "XPDFMON2.DLL" [null data]
---------- (launch time: 2008-12-16 08:51:14)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 38 seconds, including 14 seconds for message boxes)
|
